JPWO2013001609A1 - Monitoring system and monitoring method - Google Patents

Abstract

The monitoring system digitizes changes in the configuration or state of the monitoring target and displays the change values. The monitoring target refers to a monitoring target device or a component of the monitoring target device. When a plurality of monitoring information acquisition intervals are used, a change value may be calculated and displayed for each of a plurality of monitoring targets. In some cases, the time axis of the monitoring value time series graph and the time axis of the change value time series graph are aligned and displayed.

Description

  The present invention relates to a monitoring system and a monitoring method for monitoring devices connected via a network.

  Conventionally, a computer system in which a plurality of host computers and storage subsystems are connected to a communication network has been constructed. In such a computer system, a monitoring system is generally provided. The monitoring system monitors various devices connected to the network.

  For example, a technique for collecting and storing performances of devices to be monitored connected to a network is known (see Patent Document 1). It is also known to display the collected performance values of monitored devices in a graph.

US Pat. No. 7,143,008

  According to the above technique, the performance value of the monitoring target device can be displayed in a graph to appropriately monitor the monitoring target device. However, it is difficult to grasp a change in configuration or a change in state in an actual computer system only with the performance value graph.

  In order to solve the above, the monitoring system quantifies a change in configuration or a change in state of a monitoring target (refers to a monitoring target device or a component of the monitoring target device) and displays the change value.

  For example, the change value is displayed as follows (however, both may not be realized simultaneously).

  (1) A change value is calculated for each of a plurality of monitoring targets and displayed on the screen. As a result, it is possible to easily grasp a change in the configuration or state of a plurality of monitoring targets. Further, the change values may be displayed in time series with a graph having a time order axis. In this case, it is possible to grasp the temporal trend of changes in a plurality of monitoring targets on one screen.

  (2) The time series of the change values is displayed on the same screen as the time series graph of the measured numerical values to be monitored in a graph having a time order axis. This facilitates analysis of the measured numerical values while taking into account changes in configuration and state.

FIG. 1 is a configuration diagram of a computer system according to an embodiment. FIG. 2 is a configuration diagram of the host computer according to the embodiment. FIG. 3 is a configuration diagram of the storage subsystem according to the embodiment. FIG. 4 is a configuration diagram of the network device according to the embodiment. FIG. 5 is a configuration diagram of the management computer according to the embodiment. FIG. 6 is a configuration diagram of a polling timer table according to the embodiment. FIG. 7 is a configuration diagram of a configuration information management table for nodes according to the embodiment. FIG. 8 is a configuration diagram of a configuration information management table for components according to the embodiment. FIG. 9 is a configuration diagram of a group table according to the embodiment. FIG. 10 is a configuration diagram of an event table according to the embodiment. FIG. 11 is a configuration diagram of an event tabulation table according to the embodiment. FIG. 12 is a configuration diagram of a display condition / filter condition table, a display condition / filter condition definition table, and a filter table according to the embodiment. FIG. 13 is a configuration diagram of an event count result table according to the embodiment. FIG. 14A is a configuration diagram of an event search result table according to the embodiment. FIG. 14B is a configuration diagram of a change type table according to the embodiment. FIG. 14C is a configuration diagram of the time width A table. FIG. 15 is a configuration diagram of a management program according to the embodiment. FIG. 16 is a configuration diagram of the display device according to the embodiment. FIG. 17 is a configuration diagram of a display program according to the embodiment. FIG. 18 is a diagram for explaining overall processing in the computer system according to the embodiment. FIG. 19A is a flowchart of a polling timer process according to the embodiment. FIG. 19B is a flowchart of information collection processing according to the embodiment. FIG. 20A is a flowchart of DB storage processing according to the embodiment. FIG. 20B is a flowchart of event creation processing according to the embodiment. FIG. 21 is a flowchart of an event counting process according to the embodiment. FIG. 22A is a flowchart of event map display processing according to the embodiment. FIG. 22B is a flowchart of event display processing according to the embodiment. FIG. 22C is a flowchart of monitoring numerical value display processing according to the embodiment. FIG. 23 is a flowchart of event count result processing according to the embodiment. FIG. 24 is a flowchart of event search result processing according to the embodiment. FIG. 25 is a display example of a monitoring screen according to the embodiment. FIG. 26 is a display example of a monitoring screen showing a change event in the time span B according to the embodiment. FIG. 27 is a display example of a monitoring screen according to a modification. FIG. 28 is a display example of a monitoring screen including a graph of event occurrence history according to the modification. FIG. 29 is a configuration diagram of a monitoring numerical value management table according to the embodiment. FIG. 30 is a diagram illustrating an example of the relationship between the time interval and the overlap period.

  Embodiments will be described with reference to the drawings. The embodiments described below do not limit the invention according to the claims, and all the elements and combinations described in the embodiments are essential for the solution of the invention. Is not limited.

  In the following description, various types of information may be described using the expression “xxx table”, but the various types of information may be expressed using a data structure other than a table. In order to show that it does not depend on the data structure, the “xxx table” can be called “xxx information”.

  In the following description, the process may be described using “program” as a subject, but the program is executed by a processor (for example, a CPU (Central Processing Unit)) included in the controller, so that a predetermined process is performed. Is performed using a storage resource (for example, a memory) and / or a communication interface device (for example, a communication port) as appropriate, and the subject of the processing may be a processor. The processing described with the program as the subject may be processing performed by a processor or a management system having the processor (for example, a display device (for example, a client) or a management computer (for example, a server)). The controller may be the processor itself or may include a hardware circuit that performs part or all of the processing performed by the controller. The program may be installed in each controller from a program source. The program source may be, for example, a program distribution server or a storage medium.

  The management computer has an input / output device. Examples of input / output devices include a display, a keyboard, and a pointer device, but other devices may be used. As an alternative to an input / output device, a serial interface or an Ethernet interface (Ethernet is a registered trademark) is used as an input / output device, and a display device having a display, a keyboard, or a pointer device is connected to the interface, and display information is displayed. It is also possible to display on the display device by transmitting to the display device or receiving input information from the display device, or to substitute the input and display on the input device by accepting the input.

  Hereinafter, a set of one or more computers that manage the computer system may be referred to as a monitoring system. When the management computer displays the display information, the management computer is a monitoring system. A combination of a management computer and a display device is also a monitoring system. In addition, in order to increase the speed and reliability of management processing, a plurality of computers may realize processing equivalent to that of the management computer. In this case, the plurality of computers (displays if the display device performs display) Monitoring system).

  In the following description, devices, parts included in the devices, devices, and programs are referred to as components. Furthermore, when it is desired to indicate a target to be monitored including both devices and components, it is called a monitoring target.

  Information acquired from the monitoring target by the monitoring system for device monitoring is called monitoring information. The monitoring information includes one or more of the following.

  Configuration information: for example, identification information of device or component, mounting position, setting. More specific examples include an IP address, a device serial number, a network card identifier, a mounting position on the PCI bus, and component type information.

  Status information: Status of the device or component. More specific examples of types include the presence or absence of a component failure. It should be noted that the temperature of a physical component such as a fan may be treated as status information in terms of leading to a device failure (particularly when comparing a temperature with a predetermined identifier). However, the temperature may be treated as a measured numerical value described later. A similar point is a numerical value indicating the load of a component (for example, there are a CPU usage rate and a memory usage rate. These are because if the rate increases extremely, the closer to the failure, the more malfunctioning occurs.)

  Measured value: A value measured for a device or component. As more specific types of examples, CPU usage rate, memory usage rate (or usage), disk usage rate (or usage) or IOPS or transfer bandwidth, communication bandwidth, communication latency, processing per unit time of application program There are numbers.

  FIG. 1 is a configuration diagram of a computer system according to an embodiment.

  The computer system includes a monitoring system 10, a host computer 300 as an example of a monitoring target device, and a storage subsystem 400 as an example of a monitoring target device. In the computer system, each of the host computer 300 and the storage subsystem 400 may be one or plural. The monitoring system 10 includes, for example, a management computer 100 configured with a host computer, and a display device 200 configured with a host computer, a client PC, or the like.

  The monitoring system 10, the host computer 300, and the storage subsystem 400 are connected via a network (for example, a LAN (Local Area Network)) 600. The network 600 includes a network device 500 such as an IP (Internet Protocol) switch. The network device 500 is also an example of a monitoring target device.

  In this computer system, the management computer 100 of the monitoring system 10 receives, from the host computer 300, the storage subsystem 400, or the network device 500, which is an example of a monitoring target device, monitoring numerical values, status information, and Collect configuration information. In the system of FIG. 1, examples of monitoring numerical values, status information, and configuration information are as follows.

  When the network device 500 is an IP switch, the state information includes, for example, a normal state in which the IP switch port is in a normal state, a warning state in which a warning is required, an emergency state in which urgent action is required, There is a link down state in which link down has occurred.

  The monitoring numerical value is information about the performance such as the communication amount and the usage amount of the component, for example. For example, when the network device 500 is an IP switch, monitoring numerical values include the network transmission amount of the port of the IP switch, the packet transmission amount, and the like. The monitoring numerical value of the host computer 300 includes the usage amount of the CPU.

  The configuration information is information about the configuration such as a node (a monitoring target device such as the host computer 300, the storage subsystem 400, and the network device 500), a component version, and a name. For example, when the network device 500 is an IP switch, the configuration information includes names of ports, power supplies, and the like that configure the IP switch.

  The display device 200 receives information to be displayed from the management computer 100 and displays a monitoring screen for the performance, status, configuration, etc. of the monitoring target device.

  In the following description, the acquisition of monitoring information by the management computer 100 is performed by a process called polling, which acquires monitoring information by sending an information acquisition request to a monitoring target device. However, at least part of the monitoring information may be acquired by processing other than polling.

  Even when the monitoring information is acquired by polling, not all monitoring targets are acquired at the same time interval for any of the following reasons.

  (1) When the interval cannot be kept due to the load of the management computer 100.

  (2) When polling is additionally executed in addition to a fixed interval according to a user instruction.

  (3) The specific information of the configuration information tends to be less changed than the specific information belonging to the state information or the measured numerical value. Therefore, in order to reduce the polling load of the management computer 100, the network, or the monitoring target, or to reduce the cost when having the configuration information in the history, the polling interval of the configuration information is set to be greater than the polling interval of the status information / measurement value. When lengthened.

  (4) In addition to the type of information as described in (3) above, it may be known that changes in the configuration, state, and measurement values of a specific device or component are gentler than other devices or components. . In this case, a long polling interval may be applied to a device or component whose change is gentle as in (3).

  Note that when a change in the configuration or status of a monitoring target is specified by polling, this change occurs between the polling time when the change was specified and the polling time when the change could not be specified last time (time interval). Identified. The change value of the present embodiment has a feature that the absolute value of the value decreases as the time interval becomes longer, and appeals that the change occurring within a shorter acquisition time interval is useful for analysis. This is particularly useful when comparatively analyzing changes over time and changes in measured values. However, even when the time series change is not analyzed, the relationship between the time interval and the change value is useful. For example, comparing the change values of a plurality of monitoring objects at a certain time suggests that the change of the monitoring object having a small change value may have occurred relatively long ago.

  In the following description, the case where the polling interval is changed depending on the type of monitoring information is described as an example, but it goes without saying that the present invention can be applied to cases where the polling interval is changed other than the type of monitoring information.

  FIG. 2 is a configuration diagram of the host computer according to the embodiment.

  The host computer 300 has a port 310, a processor 320, and a memory 330. The port 310 mediates communication via the network 600. The memory 330 stores a program executed by the processor 320, information required by the processor 320, and the like. In the present embodiment, the memory 330 stores programs such as an application 331, an operating system 332, and a device management program 333. The device management program 333 is a program for transmitting configuration information, monitoring numerical values, and status information of the host computer 300 to the management computer 100. The processor 320 executes various processes by executing a program stored in the memory 330. For example, the processor 320 executes the device management program 333, and when there is a poll from the management computer 100, information on the host computer 300 requested by the polling (monitoring information: configuration information, monitoring numerical value, or status information) Is transmitted to the management computer 100 via the port 310.

  FIG. 3 is a configuration diagram of the storage subsystem according to the embodiment.

  The storage subsystem 400 includes a storage controller 410 and a plurality of disk devices 420.

  The storage controller 410 includes an I / O port 411, a management port 412, a processor 413, and a storage resource 414 configured by a memory and / or a disk device. The I / O port 411 mediates communication with the host computer 300 or the like via the network 600. The management port 412 mediates communication with the management computer 100 via the network 600. The storage resource 414 stores a program executed by the processor 413, information required by the processor 413, and the like. In this embodiment, the storage resource 414 stores programs such as the device management program 415. The device management program 415 is a program for transmitting the configuration information, monitoring numerical values, and status information of the storage subsystem 400 to the management computer 100. The processor 413 executes various processes by executing a program stored in the storage resource 414. For example, the processor 413 manages the information (configuration information, monitoring numerical value, or status information) of the storage subsystem 400 requested by the polling when the management computer 100 is polled by executing the device management program 415. The data is transmitted to the computer 100 via the management port 412.

  In the present embodiment, a RAID (Redundant Array of Independent (or Inexpensive) Disks)) group 421 is configured by the storage areas of the plurality of disk devices 420. The storage area of the RAID group 421 is allocated as the storage area of the volume 422.

  The storage subsystem 400 may include a storage device (for example, a flash memory drive) having other types of storage media in addition to the disk device 420 or instead of the disk device 420.

  FIG. 4 is a configuration diagram of the network device according to the embodiment.

  The network device 500 is an IP switch, for example, and includes a plurality of ports 501, a management port 502, a processor 503, and a storage resource 504 configured by a memory and / or a disk device.

  The port 501 mediates communication with the host computer 300, the storage subsystem 400, and the like via the network 600. The management port 502 mediates communication with the management computer 100 via the network 600. The storage resource 504 stores a program executed by the processor 503, information required by the processor 503, and the like. In this embodiment, the storage resource 504 stores programs such as the device management program 505. The device management program 505 is a program for transmitting configuration information, monitoring numerical values, and status information of the network device 500 to the management computer 100. The processor 503 executes various processes by executing a program stored in the storage resource 504. For example, the processor 503 executes the device management program 505, and when there is a polling from the management computer 100, the processor 503 manages the information (configuration information, monitoring numerical values, or status information) of the network device 500 requested by the polling. 100 to the terminal 100 via the management port 502. Note that the monitoring target device may transmit monitoring information from other than the management port.

  FIG. 5 is a configuration diagram of the management computer according to the embodiment.

  The management computer 100 includes a port 101, a processor 102, an input / output device 103, and a storage resource 104 configured by a memory and / or a disk device.

  The port 101 mediates communication with a plurality of monitoring target devices (host computer 300, storage subsystem 400, network device 500, etc.) via the network 600. The input / output device 103 includes, for example, an input device such as a mouse and a keyboard, and an output device (display device) such as a liquid crystal display. The input / output device 103 accepts input from an operator of the management computer 100 and displays and outputs information to the operator. To do.

  The storage resource 104 stores a program executed by the processor 102, information required by the processor 102, and the like. In this embodiment, the storage resource 104 stores an operating system 110 and programs such as a management program 140. The management program 140 collects configuration information, monitoring numerical values, and status information of monitoring target devices (nodes) and / or components (components) of the monitoring target devices, and graphs regarding the configuration, performance, status, and the like of the monitoring target devices And a monitor screen including information are displayed on the display device 200.

  The computing resource 104 includes a configuration information management table (node) 121, a configuration information management table (component) 122, a group table 123, a display condition / filter condition definition table 124, an event table 125, and an event totaling table. 126, event search result table 127, event tabulation result table 128, polling timer table 129, change type table 130, time width A table 131, display condition / filter condition table 132, filter table 133, the collection information table 134, and the monitoring numerical value management table 139 are stored. The collection information table 134 stores information for specifying the monitoring target, information for identifying the monitoring numerical value type of the monitoring target device, the monitoring numerical value collected from the monitoring target, and the collected time in association with each other. For example, the collection information table 134 includes information for specifying the CPU of the monitoring target device, information indicating the usage rate of the CPU, which is an example of the monitoring numerical value of the monitoring target device, a monitoring numerical value (CPU usage rate value), The time when polling is started is stored in association with each other.

  The processor 102 executes various processes by executing a program stored in the storage resource 104. For example, the processor 102 executes the management program 140 and uses the tables 121 to 134, 139, and the like to execute monitoring processing of the monitoring target device.

  FIG. 6 is a configuration diagram of a polling timer table according to the embodiment.

  The Polling timer table (TBL_POLLING) 129 is a table for managing the time of performing polling for collecting information for each monitoring target device.

  The Polling timer table 129 includes information types, intervals, and next information collection start times. The information type is the type of information acquired by polling, and in this embodiment, there are status information, monitoring numerical values, and configuration information. The interval is an interval for performing polling for acquiring the corresponding type of information. In this embodiment, the status information is set to be polled at intervals of 15 minutes, the monitoring value is set to be polled at intervals of 5 minutes, and the configuration information is set to be polled at intervals of 1 day. . That is, in the present embodiment, the status information, the monitoring numerical value, and the configuration information are set to perform polling at different time intervals. This is because the status information, monitoring numerical values, and configuration information include the frequency with which each piece of information is required, the average time at which some sort of change is expected to occur, and the size of each piece of information. This is because at least one of them varies depending on the type of information. The next information collection start time is a time at which polling for collecting next information is started.

  FIG. 7 is a configuration diagram of a configuration information management table for nodes according to the embodiment.

  A configuration information management table (TBL_NODE) 121 for a node (monitored device) includes a node ID, a node type, a node name, an IP address, authentication information (ID / password), an information collection start time, and a group. ID.

  The node ID is an identifier that uniquely identifies the node. The node type is a node type. Examples of the node type include a server (SERVER), a storage (STORAGE), and a fiber channel switch (FC-Switch). The node name is a name given to the node. The IP address is an IP address assigned to the node. The information collection start time is a polling start time (information collection start time) when the information is collected. The group ID is a unique identifier for a group composed of a plurality of nodes. By using groups, a plurality of nodes can be used for various processes in units of groups.

  For example, according to the first record in the figure, the node with the node ID “Server1” has the node type “SERVER”, the node name “Server1”, and the IP address “111.112.113”. .101 ”, the authentication information ID is“ Administrator ”, the password is“ AdminPW1 ”, and the polling start time when the information is collected is“ 2010/6/8 18:20 ” It can be seen that the group ID of the node is “Server1”.

  FIG. 8 is a configuration diagram of a configuration information management table for components according to the embodiment.

  The component configuration information management table (TBL_COMPO) 122 includes a component ID, a component type, a component name, and a parent node ID.

  The component ID is an identifier that uniquely identifies a component (component) constituting the node. The component type is a type of component. Component types include LAN adapter (LAN_ADAPTER), ISCSI disk (ISCSI_DISK), application (APPLICATION), file system (FILE_SYSTEM), storage disk (STORAGE_DISK), storage volume (STORAGE_VOLIME), storage logical unit (STORAGE_LU), fiber channel There is a port (FC_PORT). The component name is a name given to the component. The parent node ID is an identifier of a node that is a parent of the corresponding component.

  For example, according to the first record in the figure, the component with the component ID “Server1 / LAN_Adapter1” has the type “LAN_ADAPTER”, the component name “LAN_Adapter1”, and the parent node ID “Server1”. I know that there is.

  FIG. 9 is a configuration diagram of a group table according to the embodiment.

  The group table 123 (GRP_NODE) is a table for managing a group of monitoring target devices. The group table 123 includes a group ID, a group name, and a node name.

  The group ID is an identifier that uniquely identifies the group. The group name is a name given to the group. The node name is a name of a node belonging to the corresponding group.

  For example, according to the first record in the figure, it can be seen that the group with the group ID “Server1” has the group name “SERVER1” and the nodes Server1, Server2, and Server3 belong to it.

  FIG. 10 is a configuration diagram of an event table according to the embodiment.

  The event table 125 (TBL_EVT) is a table that manages events such as configuration changes and state changes that occur between the time when the previous information is collected and the time when the current information is collected. The event table (TBL_EVT) 125 includes an event ID, a node ID, a component ID, an event or state type, a previous information collection start time, a category, an information collection start time, a node change type, and a component change. Including type.

The event ID is an identifier that uniquely identifies the event. The node ID is an identifier of a node related to the corresponding event. The component ID is an identifier of a component related to the corresponding event. The event or state type is the corresponding event type or state. The previous information collection start time is a time at which the collection of information corresponding to the event was started last (a reference time at the previous acquisition). A category is a type of collected information. Therefore, the category may take, for example, a configuration and a status, but may take a value such as a monitoring numeric value. The information collection start time is the time when the collection of the current information is started (the reference time at the time of the current acquisition). The node change type is a change type for the node. The change type includes a change indicating that a node has been changed (Changed), an addition indicating that a node has been added (Added), and a deletion indicating that a node has been deleted (Removed). The component change type is a change type for the component. The change type includes a change indicating that the component has been changed (Changed), an addition indicating that the component has been added (Added), a deletion indicating that the component has been removed (Removed), and no change to the component No change shown (Not
Changed) etc.

  FIG. 11 is a configuration diagram of an event tabulation table according to the embodiment.

  The event totaling table 126 (TBL_EVTTOTAL) includes time, change value, node change type, component change type, node ID, and component ID.

  The node change type is a change type for the node. The component change type is a change type for the component. The node ID is a node identifier. The component ID is a component identifier. The change value is the amount (change value) of a change event corresponding to the change type in the corresponding node component in a predetermined time unit (in this example, unit time, for example, 1 minute) indicated by the time. Converted to. Here, in this embodiment, the change value is the number of events, the time width (polling interval, more specifically, the previous information collection start time and the current information collection start time) It is obtained by dividing by (time width). However, the conversion process for obtaining the change value is an example. In the event totaling table 126, a change value corresponding to the number of events is stored in association with each predetermined time unit within the polling interval. That is, the value related to the occurrence of an event can be managed in units of time shorter than the polling interval. Thereby, by using the record of the event totaling table 126, it is possible to appropriately display the event occurrence graph with a time width smaller than the polling interval.

  For example, according to the first record in the figure, in the unit time indicated by “6/8 18:10”, the node with the node ID “Server2” and the component with the component ID “Server2 / Application1” added (Added ) Event change value is found to be 0.01.

  FIG. 12 is a configuration diagram of a display condition / filter condition table, a display condition / filter condition definition table, and a filter table according to the embodiment.

  The display condition / filter condition table 132 (TBL_EVTFILTER) stores display conditions and filter conditions selected on the monitoring screen of the display device 200. Conditions that can be set include node ID, component ID, node change type, component change type, time width A, and time width B (target time width). The time width A is the entire width of the time axis of the graph displayed on the monitoring screen, and the time width B is the time width selected by the user in the time width A. In the figure, for the node with the node ID “Server1” and the component ID “Server1 / CPU”, the target is all node change types, the target is all component change types, and the time span A is It is shown that it is selected that the time width B is 6 hours with 12 hours.

  The display condition / filter condition definition table 124 (TBL_EVTFILTERDEFINE) indicates a filter for detecting a condition for searching for an event necessary for creating the map or the like for each type of graph (map) or the like displayed on the monitoring screen. It is a table. In the figure, conditions necessary for search are displayed in white, and unnecessary conditions are displayed in gray. For example, the conditions for displaying the event list are a node change type, a time width B, a node ID, and a component ID. Further, the conditions for displaying the node map are the node change type, the time width A, and the node ID.

  The filter table 133 (TBL_FILTER) stores the name of the filter when the filter of the display condition / filter condition definition table 124 is applied to the contents of the display condition / filter condition table 132. In this embodiment, the filter name is obtained by extracting and combining the contents of necessary conditions in each filter of the display condition / filter condition definition table 124 from the contents of the display condition / filter condition table 132. The filter name A for the event list filter in the filter table 133 is extracted from the contents of the display condition / filter condition table 132 for the node change type, time width B, node ID, and component ID necessary for the event list filter. “All, none, none, 6 hours, Server1, CPU”.

  FIG. 13 is a configuration diagram of an event count result table according to the embodiment.

  The event totaling result table 128 (TBL_EVTTOTALRESULT) stores the filter name when searching based on the contents specified in the display condition / filter condition table 132 and the search result searched from the event totaling table 126 using the filter. It is a table.

  The event totaling result table 128 includes a filter name, a time, a change value, a node change type, a component change type, a node ID, and a component ID. The filter name is the name of the filter used when searching. The time, the change value, the node change type, the component change type, the node ID, and the component ID are totals for events (event records) obtained from the event total table 126 using search conditions. According to the event totaling result table 128, it is possible to appropriately manage a record indicating a predetermined unit time width for an event that matches a condition.

  FIG. 14A is a configuration diagram of an event search result table according to the embodiment. FIG. 14B is a configuration diagram of a change type table according to the embodiment. FIG. 14C is a configuration diagram of the time width A table.

  The event search result table 127 (TBL_EVTRESULT) is a table that stores events that match the conditions specified in the display condition / filter condition table 132 and may have occurred within the time specified by the time width B. The event search table 127 includes an event ID, a node ID, a component ID, an event or state type, a previous information collection start time, a category, an information collection start time, a node change type, and a component change type. , Including probability. Event ID, node ID, component ID, event or state type, previous information collection start time, category, information collection start time, node change type, and component change type are the contents of the record of the event specified from the event table 125 It is. The probability is a probability (occurrence probability) that the corresponding event occurs in the time width B. In the present embodiment, it is the ratio of the overlapping time between the time width in which the event may have occurred and the time width B in the time width in which the event may have occurred.

  The change type table 130 (TBL_EVTPAT) stores selection candidates for node change types and component change types. Selection candidates include “Any” indicating that the node change type and the component change type may be any, “Added node” indicating that the node change type is the addition of a node, and the node change type indicating that the node has been removed. “Removed node” indicates that the node change type is a node change, and the component change type indicates “added node-Added component” indicating that a component is added.

  The time width A table 131 (TBL_TIMEPAT) stores selection candidates for the time width A. Selection candidates include 1 hour, 6 hours, 12 hours, 24 hours, 7 days, and the like.

  FIG. 29 is a configuration diagram of a monitoring numerical value management table according to the embodiment.

  The monitoring numerical value management table 139 (TBL_MONITORVAL) includes time, node ID, component ID, monitoring numerical value type, and monitoring numerical value.

  The time is the information collection start time. The node ID is a node identifier. The component ID is a component identifier. The monitoring numerical value type is a monitoring numerical value type. The monitoring numerical value is a monitoring numerical value.

  FIG. 15 is a configuration diagram of a management program according to the embodiment.

  The management program 140 includes a polling timer 141, a configuration information collection unit 142, a status information collection unit 143, a monitoring numerical value collection unit 144, a DB storage unit 145, an event creation unit 146, an event aggregation registration unit 147, It has an event registration unit 148, an event totaling result creation unit 149, and an event search result creation unit 150.

  The Polling timer 141 uses the Polling timer table 129 to measure the time to start collecting state information, monitoring numerical values, and configuration information, and notifies the configuration information collecting unit 142, the state information collecting unit 143, and the monitoring numerical value collecting unit 144. To do. The configuration information collection unit 142 collects configuration information from the monitoring target device. The status information collection unit 143 collects status information from the monitoring target device. The monitoring numerical value collection unit 144 collects monitoring numerical values from the monitoring target device. The DB storage unit 145 compares the collected various information with the previously collected various information. The event creation unit 146 executes event creation processing. The event creation process will be described later. The event aggregation registration unit 147 executes event aggregation processing. The event counting process will be described later. The event registration unit 148 executes processing for registering the event created by the event creation unit 146. The event total result creation unit 149 executes event total result processing. The event count result process will be described later. The event search result creation unit 150 executes event search result processing. The event search result process will be described later.

  FIG. 16 is a configuration diagram of the display device according to the embodiment.

  The display device 200 includes a port 201, a processor 202, and a storage resource 204 configured by a memory and / or a disk device.

  The port 201 mediates communication with the management computer 100 via the network 600. The input / output device 203 includes, for example, an input device such as a mouse and a keyboard, and an output device such as a liquid crystal display. The input / output device 203 accepts input from an operator of the display device 200 and displays information for the operator. The storage resource 204 stores a program executed by the processor 202, information required by the processor 202, and the like. In this embodiment, the storage resource 204 stores a display program 205 and the like. The display program 205 is a program for causing the input / output device 203 to display a monitoring screen including the configuration, performance, status, and the like of the monitoring target device based on information transmitted from the management computer 100. The processor 202 executes various processes by executing a program stored in the storage resource 204. For example, the processor 202 executes various types of operator inputs from the input / output device 203 by executing the display program 205, and relates to the configuration, performance, and status of the monitoring target device based on information from the management computer 100. A monitoring screen is displayed on the input / output device 203.

  FIG. 17 is a configuration diagram of a display program according to the embodiment.

  The display program 205 includes an event display unit 206, an event map display unit 207, and a monitoring numerical value display unit. The event display unit 206 displays information on events that have occurred in the monitoring target device. The event map display unit 207 displays a map of events that have occurred in the monitoring target device, that is, a graph of event occurrence with respect to time changes. The monitoring numerical value display unit displays the monitoring numerical value acquired from the monitoring target.

  The storage of the display program 205 in the storage resource 204 may be performed by the management computer 100 transmitting the program to the display device in response to a request from the display device. The display program 205 and the management program 140 may be originally stored in the same storage medium or may be stored in different storage media. Similarly, the display program 205 and the management program 140 may be originally stored in the same program distribution computer, or may be stored in different program distribution computers.

  Next, processing of the computer system according to the embodiment will be described.

  FIG. 18 is a diagram for explaining overall processing in the computer system according to the embodiment.

  When the processor 102 of the management computer 100 executes the management program 140, a polling timer process is executed, and when a predetermined time is reached, an information collection process is executed. Then, the processor 102 executes DB storage processing using the collected information and the information of the configuration DB 135 (configuration information management table (node) 121, configuration information management table (component) 122). Next, the processor 102 executes an event creation process on the information changed by the DB storage process, and registers the event in the event DB 136 (event table 125). Further, the processor 102 executes an event totaling process, and stores the totaling result in the event totaling DB 137 (event totaling table 126). The DB storage process also stores the monitoring numerical value in the monitoring numerical value DB 138 (monitoring numerical value management table 139).

  On the other hand, the processor 202 of the display device 200 executes the display program 205, thereby executing the event map display process and causing the management computer 100 to execute the event count result process. The processor 102 of the management computer 100 executes event totaling result processing, stores it in the event totaling DB 137 (event totaling result table 128), and transmits the totaling result to the display device 200. The display device 200 displays a monitoring screen on the input / output device 203 using the counting result.

  Further, the processor 202 of the display device 200 executes event display processing, and causes the management computer 100 to execute event search result processing. The processor 102 of the management computer 100 executes event search result processing, stores it in the event totalization DB 137 (event search result table 127), and transmits the search result to the display device 200. The display device 200 displays a monitoring screen on the input / output device 203 using the search result.

  The management program 205 also acquires the value stored in the monitoring numerical value DB 138 from the management program 140 and displays the monitoring numerical value on the input / output device 203 (monitoring numerical value display processing).

  FIG. 19A is a flowchart of a polling timer process according to the embodiment. FIG. 19B is a flowchart of information collection processing according to the embodiment.

  In the polling timer process, the processor 102 of the management computer 100 repeatedly executes steps S1 to S6. First, the processor 102 extracts the next information collection start time for each information type in the polling timer table 129 (step S2), waits until the next information collection start time is reached (step S3), and reaches the next information collection start time. In that case, an information collection process is executed (step S4). Next, the processor 102 updates the next information collection start time by adding the interval to the next information collection start time for the target information subjected to the information collection processing in the polling timer table 129 (step S5). And the information collection process about the information of each information type is performed by repeating the process of step S1-S6.

  In the information collection process, the processor 102 repeatedly executes the processes of steps S11 to S14 for each node ID in the configuration information management table 121.

  First, the processor 102 collects information (configuration information, status information, or monitoring numerical value) to be collected this time from the corresponding node using the IP address and authentication information of the configuration information management table 121 (step S12), and the DB A storage process is executed (step S13). Then, the processor 102 finishes the information collection process after completing the process for all the nodes, and returns to the polling timer process.

  FIG. 20A is a flowchart of DB storage processing according to the embodiment. FIG. 20B is a flowchart of event creation processing according to the embodiment.

  In the DB storage processing, the processor 102 stores the collected monitoring numerical value in the monitoring numerical value management table 139 when the collected monitoring information includes a monitoring numerical value (step S200). The processor 102 acquires the previously collected information from the collected information table 134 (step S21) and compares it with the information collected this time (step S22).

  As a result, if the information collected this time matches the information collected last time (for example, if the collected information is status information, the status is the same; if the collected information is configuration information, the monitored device (Yes in step S23), since no event of configuration change or state change has occurred, the processor 102 advances the process to step S26.

  On the other hand, if the information collected this time does not match the information collected last time, there will be events that change the status or events whose configuration has been added, changed, deleted, etc. This means that it has occurred, so the processor 102 executes an event creation process (step S24). Next, the processor 102 reflects new information on the configuration information management table (node) 121 and the configuration information management table (component) 122 (step S25), and proceeds to step S26.

  In step S26, the processor 102 updates the information collection start time of the configuration information management table (node) 121 to the current information collection start time, finishes the DB storage process, and returns to the information collection process.

  In the event creation process, the processor 102 creates a record corresponding to the generated event (step S31), and adds the record of the event to the event table 125 (step S32). Here, the previous information collection start time of the event record regarding the configuration change is the information collection start time of the configuration information management table (node) 121, and the information collection start time is the current information collection start time.

  Next, the processor 102 executes an event totaling process (step S33), and returns to the DB storage process.

  FIG. 21 is a flowchart of an event counting process according to the embodiment.

  In the event counting process, the processor 102 identifies the time width in which the event has occurred from the previous information collection start time and the information collection start time of the record corresponding to the event (step S41), and the time width in which the number of occurrences of the event has been identified. To calculate a change value that is the number of occurrences per unit time (step S42). Next, the processor 102 is a record of the time included between the previous information collection start time and the information collection start time in the event totaling table 126, and for the change values for the node and component records corresponding to the event. The calculated change value is added (step S43), and the process returns to the event creation process. In step S43, if there is a record corresponding to a plurality of time units included in the specified time width and there is no record for the node and component corresponding to the event, the record is created in the event aggregation table 126. To do.

  FIG. 22A is a flowchart of event map display processing according to the embodiment. FIG. 22B is a flowchart of event display processing according to the embodiment. FIG. 22C is a flowchart of monitoring numerical value display processing according to the embodiment.

  In the event map display process, the processor 202 of the display device 200 acquires the display condition selected on the monitoring screen (step S51), and transmits it to the management computer 100. In the management computer 100, the processor 102 receives the display condition, and executes event totaling result processing (step S52). The processor 202 of the display device 200 generates and displays a monitoring screen (see FIG. 25) based on the event total result returned from the management computer 100 by the event total result process (step S53). Here, the processor 202 displays the performance axis and the time axis of the change event map together. The event map display process is started when a request for displaying the monitoring screen (see FIG. 25) is received from the display device, for example.

  For example, the event display process starts when the change tab 705 is pressed on the monitoring screen (see FIG. 25), and the processor 202 of the display device 200 acquires the display condition selected on the monitoring screen. (Step S71) and transmitted to the management computer 100. In the management computer 100, the processor 102 receives the display condition and executes event search result processing (step S72). The processor 202 of the display device 200 generates and displays a monitoring screen (see FIG. 26) based on the event search result returned from the management computer 100 by the event search result process (step S73).

  The monitoring numerical value display process is started when a request for displaying the monitoring screen (see FIG. 25) is received from the display device, for example. As another example of starting processing, execution is started when the monitoring numerical value tab 705 is pressed on the monitoring screen (see FIG. 25), and the processor 202 of the display device 200 displays the display condition selected on the monitoring screen. Is transmitted to the management computer 100 (step S75). In the management computer 100, the processor 102 receives the display condition, reads the monitoring numerical value corresponding to the display condition from the monitoring numerical value management table 139, and transmits it to the display device 200 (not shown). The processor 202 of the display device 200 displays the monitoring numerical value received from the management computer 100 (step S76).

  FIG. 23 is a flowchart of event count result processing according to the embodiment.

  In the event totaling result process, the processor 102 of the management computer 100 registers the received condition in the display condition / filter condition table 132, applies the condition to the display condition / filter condition definition table 124, and filters corresponding to each map. A name is derived and registered in the filter table 133 (step S61).

  Next, the processor 102 executes the processes of steps S62 to S65 for all the records in the event totaling result table 128.

  First, the processor 102 determines whether or not the derived filter name matches the filter name of the record (step S63). If there is a match (Yes in step S63), the event count result table All records with the same filter name of 128 are returned to the display device 200 as an event total result (step S64).

  On the other hand, if there is no match (No in step S63), the processes in steps S66 to S69 are executed for all records in the event tabulation table 126.

  The processor 102 determines whether or not the record to be processed matches the display condition / filter condition (step S67). If they match (Yes in step S67), the processor 102 records the record having the derived file name as an event. The record is added to the total result table 128 and the record is returned to the display device 200. On the other hand, if they do not match (No in step S67), the process proceeds to the next record.

  According to this event totaling result process, a record in the event totaling table 126 that meets the conditions is returned to the display device 200 as an event totaling result. In the display device 200, as shown in FIG. Based on this, in the monitoring numerical value display area 704d, a graph of change values of events in the target range having a time axis (for example, a common time axis) corresponding to the time axis in the performance change graph for the monitoring target device is displayed. Is done. Thereby, the operator can grasp | ascertain easily and appropriately generation | occurrence | production of the event relevant to a performance change.

  FIG. 24 is a flowchart of event search result processing according to the embodiment.

  In the event search result process, the processor 102 of the management computer 100 registers the received condition in the display condition / filter condition table 132, and executes the processes in steps S81 to S86 for all records in the event table 125.

  The processor 102 determines whether the previous information collection start time of the record to be processed is before the end time specified by the time width B and the current information collection start time is later than the start time specified by the time width B. It is determined whether or not (step S82).

  As a result, when the previous information collection start time of the record to be processed is before the end time specified by the time width B and the current information collection start time is later than the start time specified by the time width B (step In S82 (Yes), the processor 102 determines whether or not the record to be processed satisfies the condition of the display condition / filter condition table 132 (step S83). As a result, when the record to be processed satisfies the condition (Yes in step S83), the time is calculated by calculating (Min (Ee, Ue) −Max (Eb, Ub)) / (Eb−Eb). The probability that an event corresponding to the record occurs in the width B is calculated (step S84). Here, Eb indicates the previous information collection start time, Ee indicates the current information collection start time, Ub indicates the start time of the time width B, Ue indicates the end time of the time width B, Min (X, Y) indicates the smaller of X and Y, and Max (X, Y) indicates the larger of X and Y.

  Next, the processor 102 registers the record information of the event corresponding to the condition and the calculated probability as a record of the event search result table 127 (step S85). If the previous information collection start time of the record to be processed is before the end time specified by the time width B, and the current information collection start time is not later than the start time specified by the time width B (in step S82). No), or if the record to be processed does not meet the condition (No in step S83), the processor 102 proceeds to the process for the next record.

  When all the records have been processed, the processor 102 transmits the records in the event search result table 127 to the display device 200 as event search results. As a result, information (including the probability of the event) about the event that may have occurred in the time width B is displayed in the change display area 705d of the monitoring screen. Therefore, the operator can appropriately grasp an event that may have occurred in the time width B on the monitoring screen. In addition, it is possible to appropriately grasp the occurrence probability of the event in the time width B.

  FIG. 25 is a display example of a monitoring screen according to the embodiment.

  The monitoring screen 700 is displayed when the processor 202 executes the display program 250 of the display device 200.

  On the monitoring screen 700, a display target type selection area 701 and a display target selection area 702 are displayed. In addition, the display area of the selected tab is displayed on the monitoring screen 700. The tab includes a monitoring numerical value tab 704t and a change tab 705t. When the monitoring numerical value tab 704t is selected, a monitoring numerical value display area 704d is displayed. When the Change tab 705t is selected, a Change display area 705d is displayed. In the figure, a monitoring numerical value tab 704t is selected and a monitoring numerical value display area 704d is displayed.

  In the display target type selection area 701, candidates of types to be displayed are displayed so as to be selectable. In the figure, groups, servers, storages, switches, and the like are displayed as candidates, and a server belonging to group A is selected.

  The display target selection area 702 displays selectable device (node) candidates belonging to the type selected by the display target type selection area 701. In the figure, Servers 1 and 2 that are servers of Group A are displayed, and Server 1 is selected as a display target.

  The monitoring numerical value display area 704d displays various types of information about the target selected in the display target selection area 702. In the monitoring numerical value display area 704d, an event type selection area 706 for selecting an event type to be displayed and a time width A selection area 707 for selecting the entire time width (time width A) of the graph to be displayed are displayed. The

  Further, in the monitoring numerical value display area 704d, a display target of the monitoring numerical value is displayed so as to be selectable, and a graph 710 of the monitoring numerical value of the selected target is displayed. The monitoring numerical value graph 710 is displayed based on the information in the collection information table 134 transmitted by the processor 102 of the management computer 100, for example. The monitoring numerical value display area 704d includes a graph (event map) 711 for the component configuration change event, a graph (event map) 712 for the node configuration change event, and a graph (event map) for the group configuration change event. ) 713 and a graph (event map) 714 of the configuration change events of all devices. The monitoring numerical value graph 710 and the graphs 711 to 714 are displayed using the same time axis (horizontal axis in the figure). Therefore, it is possible to easily and appropriately grasp the occurrence of the configuration change event at the time when the monitoring numerical value is changed from the graph. In the graphs 711 to 714, the configuration change events of addition, change, and deletion are displayed in different modes (for example, different colors). In addition, for the graph 710 and the graphs 711 to 714, a start time designation bar 725b for designating the start time of the time width B so that a part of the time width (time width B) of interest by the operator can be designated. And an end time designation bar 725e for designating the end time of the time width B is displayed. The start time designation bar 725 b and the end time designation bar 725 e can be moved by dragging with the input / output device 203.

  In each of the graphs 711 to 714, when the Change tab 705t is selected, selection buttons 721 to 724 for selecting whether or not to display the Change event for the target displayed by the graph are displayed. . The selection buttons 721 to 724 are controlled so that they can be specified only in the graph in which the change event occurs in the time width B.

  Although illustration is omitted for the sake of space, scales may be displayed on the time axes of the graphs 711 to 714. However, it is not necessary to have the same scale unit including the graph 710. For example, the graph 710 may have a scale of 5 minutes, while the graphs 711 to 714 may have a scale of 15 minutes. That is, it can be said that a pair of scales (not necessarily adjacent to each other) indicating a common time zone may exist in each graph.

  When both the change value or the monitoring numerical value is expressed as a histogram with a predetermined period as a unit, the length on the axis indicating the predetermined period on the time axis of the change value graph and the predetermined value on the time axis of the monitoring numerical value graph The length on the axis indicating the period may be the same. In this case, it is easy to confirm the temporal transition of both values even in the histogram.

  Note that one of the change value or the monitoring numerical value may be expressed as a histogram with a predetermined period as a unit, and the other one may be displayed as a normal graph. In this case, the length on the time axis indicating the predetermined period of the histogram of the histogram format graph may be the same as the length on the time axis indicating the predetermined period of the normal graph. Also in this case, it is easy to confirm the temporal transition of both values.

  FIG. 26 is a display example of a monitoring screen showing a change event in the time span B according to the embodiment.

  The monitoring screen shown in the figure is a display example when the Change tab 705t is selected and the Change display area 705d is displayed. In the Change display area 705d, information on events that occurred in the time width B specified in the monitoring numerical value display area 704d is displayed. The event information includes, for example, a device name, a changed part, a model change type, a part change type, a date, a state, detailed information, and a probability. The probability is a probability indicating the possibility that the corresponding event has occurred in the time width B.

  Next, a modified example will be described.

  In this modification, the monitoring screen in the above-described embodiment is another aspect.

  FIG. 27 is a display example of a monitoring screen according to a modification.

  A Change History button 730 for displaying a history of change events is displayed in the monitoring numerical value display area 704d of the monitoring screen 700 according to the modification. In addition, in the monitoring numerical value display area 704d, the display target of the monitoring numerical value is displayed so as to be selectable, the graph 710 of the monitoring numerical value of the selected target is displayed, and the start time specification for specifying the start time of the time width B A bar 725b and an end time designation bar 725e for designating the end time of the time width B are displayed.

  FIG. 28 is a display example of a monitoring screen including a graph of event occurrence history according to the modification. FIG. 28 shows an example of a monitoring screen when the Change History button 730 is pressed on the monitoring screen 700 shown in FIG.

  When the Change History button 730 is pressed on the monitoring screen illustrated in FIG. 27, the processor 202 of the display device 200 displays an event occurrence history graph (event occurrence history graph) in the display target selection area 702. In the event occurrence history graph, the processor 202 displays events related to configuration change (Change events) and events related to failures (Critical events) in different modes. The processor 202 also includes a start time bar 730b indicating the start time of the time width B and an end time of the time width B so that the time width B specified in the monitoring numerical value display area 705d can be specified in the event occurrence history graph. An end time bar 730e is displayed. Thus, since the time width B can be specified in the event occurrence history graph, the events related to the performance change can be appropriately grasped from the event occurrence history graph.

  Although the embodiment has been described above, it is needless to say that the claims of the present application are not limited to the embodiment and can be variously modified without departing from the scope of the invention.

  For example, in the above embodiment, in the monitoring screen 700 shown in FIG. 25, the event map of the component which is a small range is arranged in order from the top of the screen to the event map of a wider range. However, the present invention is not limited to this, and the event map may be arranged in order from the top of the screen from a wide range of event maps to a small range of event maps.

  In the above embodiment, in the event totaling table 126, the time width of each record is set as a unit time. However, the present invention is not limited to this, and it may not be a unit time. In short, it may be a predetermined time unit. That's fine.

  Moreover, in the said Example, it was set as the time which started acquisition of information as the reference | standard time at the time of information acquisition, However, The said Example is not restricted to this, Time from the end of acquisition of information, or from acquisition start to acquisition end It is good also as time between. Also, the information acquisition process and the time measurement process are not processed at the same time, and atomic processing is not guaranteed like real-time processing, so even if time measurement is performed before and after the information acquisition process, there will be a gap. It will occur. When it is set as acquisition time or acquisition time in an Example and a claim, these modification examples shall be included. Therefore, the time when expressed as “acquisition time (or acquisition time) of xxx information” is (1) when the time is displayed to the user of the monitoring system, the time when the xxx information can be sufficiently acquired can be specified. It is only necessary to satisfy the accuracy, or (2) the accuracy capable of calculating the time difference or the time interval from the previous xxx information acquisition time based on the time. This point is not limited to information but is common to processes related to various times and times. Of course, the same applies to the start time (start time) and the end time (end time).

  In the above description, as the monitoring system that includes one or more processors and one or more storage resources, and monitors a monitoring target device or / and a component included in the monitoring target device as a monitoring target, the one or more processing units The storage resource stores a first time interval and a second time interval for acquiring monitoring information of a monitoring target, and the first time interval and the second time interval are different monitoring targets or monitoring information. Applicable types. The one or more processors have been described to do the following:

  (A1) According to the first time interval, first monitoring information that is the first type of monitoring information to be monitored is acquired. (A2) According to the second time interval, second monitoring information that is the second type of monitoring information to be monitored is acquired. (B1) A change from the previous time is specified for the first monitoring information, and a first change value is calculated based on the specified change and the first time interval. (B2) A change from the previous time is specified for the second monitoring information, and a second change value is calculated based on the specified change and the second time interval. (C) The first change value and the second change value are displayed on the same screen.

  The calculation of the first change value and the second change value is generated based on a predetermined conversion process having a characteristic that the absolute value of the change value becomes smaller as the time interval based on the calculation becomes longer. As an example of this predetermined conversion process, a value obtained by dividing the number of events by the time interval between the previous monitoring information collection time and the current monitoring collection time has been described. However, the predetermined conversion process may be another formula as long as the absolute value of the change value decreases as the time interval increases. This means that when the change value is always a positive value, this characteristic is “a characteristic that the change value becomes smaller as the time interval becomes longer”. When the change value is always a negative value, this characteristic is It can be said that the characteristic indicates “the change value increases as the time interval increases”. In addition, this predetermined conversion process may be said to be “the change value approaches zero when the time interval becomes longer”.

  For example, in the case of an event that means deletion, the predetermined conversion process includes an example in which the number of events is handled as a minus value. The number of other events may be divided by the nth power of the time interval, or a value converted by the log function or exponential function. Also, the predetermined conversion processing is set to zero when the time interval exceeds a certain value (constant 1 / constant 2), such as Max (number of events × constant 1—time interval × constant 2, 0). May be.

  Note that the first and second time intervals may be used properly depending on the type of monitoring information, or may be used depending on the monitoring target.

  The monitoring system obtains the acquisition time of the first monitoring information that is the source of the first change value, the period of the previous acquisition time (first period), and the second monitor that is the source of the second change value. The information acquisition time and the previous acquisition time period (second period) at least partially overlap, and the display of the first change value is temporally related to the second change value. It was also explained that it may be displayed. This related display has, for example, the screen of FIG. 25 (however, when time series display is not performed, it is not necessary to be a graph display). As other related displays, it is possible to arrange the first change value and the second change value corresponding to the time frame in a tabular format in a row or a column, or the first change value and the second change value may be arranged in a straight line or the like. It is also conceivable to display the images by tying them together. The first period is typically the first time interval, and the second period is typically the second time interval. Therefore, for example, when the first time interval is acquired at 0: 1 in one day and the second time interval is acquired every other hour at 0 minute, the first period is, for example, 2011/03/01 00 01:00 to less than 2011/03/02 00:01:00 (00:00:59 if managed in 1 second increments), the second period starts from, for example, 2011/03/01 00:00:00 It is less than 01:00:00 (00:59:59 for management in 1 second increments). Therefore, the overlapping period is from 00:01:00 to less than 01:00:00 on 2011/03/01 (00:59:59 if managed in increments of 1 second) (see FIG. 30).

  Note that (C) includes (C1) a first graph that displays the first change values in time series on the basis of the first axis indicating the time order, and the second graph on the basis of the second axis that indicates the time order. A second graph that displays change values in time series, (C2) the first axis and the second axis are in the same direction, and (C3) a portion on the first axis that indicates the overlap period May overlap with a portion on the second axis indicating the overlap period when moving in a predetermined angular direction with the first axis. In FIG. 25, the graph is an accumulation graph, but other graphs may be used as long as the change values can be displayed in time series. Further, the first change value and the second change value may be displayed on the same graph.

  The time series display of the change values may be displayed in a table format in which the first change values and the second change values are displayed in time series on the basis of a predetermined row or column indicating the time order.

  The one or more storage resources store monitoring numerical time-series information (for example, time-series information such as a monitoring numerical value management table) including a first monitoring numerical value related to the first monitoring target. The above processor displays (D) a third graph that displays the first monitoring numerical value in time series based on the third axis representing the time order, and (D1) the first axis and the third axis. Are directed in the same direction, and (D2) the portion on the first axis indicating the overlap period is moved in the predetermined angular direction with respect to the first axis, and the portion on the third axis indicating the overlap period You may make it overlap. The predetermined angular direction is typically 90 degrees above the time axis extending in the horizontal direction as shown in FIG. However, the angle may be approximately 90 degrees or 45 degrees. This is also common when the display device includes a three-dimensional display device.

  The change value may be displayed as a histogram for each predetermined period as shown in FIG. Even if a time series graph of change values such as 711 to 714 in FIG. 25 is displayed in the column 705d in FIG. 28, if the start date and time and end date and time of the histogram and change value graph are aligned vertically (that is, a predetermined angle) 90 degrees), it is easy to compare the change values simultaneously. The same applies to the case where the change value is represented in a histogram format and the measured numerical value is represented in a graph format in the case of FIG.

  The one or more processors receive (E) a display request designating a predetermined display time period, and (F) change the first monitoring information generated within the predetermined display time period. It is displayed together with the probability of occurrence within a predetermined display time zone, and the probability of (F) is the period of the acquisition time of the first monitoring information and the previous acquisition time that is the source of the change of the first monitoring information. The ratio may be calculated based on a ratio included in the predetermined display time zone. The calculation method may be other than (Min (Ee, Ue) −Max (Eb, Ub)) / (Eb−Eb). Typically, if other numerical values are the same, a function whose value tends to increase when the degree of overlap between the above-described period (ie, Eb to Ee) and time width B (ie, Ub to Ue) is large may be used. .

  The first monitoring target is a predetermined component included in a predetermined monitoring target device, and the change from the previous time regarding the first monitoring information is addition, change, or deletion of the predetermined component. Yes, the second monitoring target is the predetermined monitoring target device, and the change from the previous time regarding the second monitoring information is included in at least the predetermined monitoring target device other than the predetermined component It may be an addition, change or deletion of a component.

  In other words, the above description is a method for monitoring a monitoring target device and / or a component included in the monitoring target device as a monitoring target, and (a0) a plurality of times for acquiring monitoring information for a plurality of the monitoring targets. (A) acquiring a plurality of pieces of monitoring information from a plurality of the monitoring targets according to the plurality of time intervals, and (B) changing each of the plurality of pieces of monitoring information from a previous time and a time interval. (C) displaying a plurality of change values corresponding to a plurality of the monitoring information on the same screen, and calculating the change value when the time interval based on the calculation becomes longer. It can also be said that it is generated based on a predetermined conversion process having a characteristic that the absolute value of the value becomes small.

  In addition, each of the plurality of change values has an acquisition time of monitoring information that is a source of calculation and a period of the previous acquisition time at least partially overlapping with a period of other change values, The display can also be said to indicate that a certain change value and another change value are temporally related.

  In addition, the display of the change values in (C) displays a plurality of change value graphs that display the plurality of change values in time series based on the first axis indicating the time order, and the plurality of first axes are It can be said that the same direction and the same time scale interval.

  Also, monitoring numerical time-series information including predetermined monitoring numerical values related to a predetermined monitoring target is stored, a numerical graph that displays the monitoring numerical values in time series with respect to the second axis indicating the time order is displayed, and the first graph is displayed. The axis and the second axis are oriented in the same direction, the length of the first part indicating the predetermined period of the first axis, the length of the second part indicating the predetermined period of the second axis, Can be said to be equal.

  And (E) receiving a display request designating a predetermined display time zone, and (F) changing the monitoring information generated within the predetermined display time zone together with the probability of occurring within the predetermined display time zone. The probability of (F) is displayed, and it can be said that the acquisition time of the monitoring information that is the source of the change and the period of the previous acquisition time are calculated by the ratio included in the predetermined display time zone. .

  The plurality of monitoring targets include at least a predetermined monitoring target device and a predetermined component included in the predetermined monitoring target device, and the change of the monitoring information related to the predetermined component from the previous time is the predetermined component It can be said that it is addition, change, or deletion.

  It can be said that the change of the monitoring information related to the predetermined monitoring target device from the previous time is at least addition, change, or deletion of a component included in the predetermined monitoring target device other than the predetermined component.

  Further, from the viewpoint that the description so far does not stick to a plurality of time intervals, the one or more processors: (1) repeatedly acquiring the first type of monitoring information of the first monitoring target, and time series of the monitoring information Storing information, (2) repeatedly acquiring a second type of measurement value of the second monitoring target, storing time series information of the measurement value, and (3) a predetermined value included in the time series information of the monitoring information For the monitoring information, the change of the predetermined monitoring information from the previous monitoring information is specified, the time interval between the acquisition time of the previous monitoring information and the acquisition time of the predetermined monitoring information is specified, and the change and A change value is measured based on the time interval, and (4) a first graph that displays the change value in time series with reference to a first axis indicating a time order, and a second axis indicating a time order. A measured value graph that displays measured values in time series and Are displayed on the same screen, and the calculation of the change value is generated based on a predetermined conversion process having a characteristic that the absolute value of the change value decreases as the time interval based on the calculation increases. The axis and the second axis are oriented in the same direction, the length of the first part indicating the predetermined period of the first axis, the length of the second part indicating the predetermined period of the second axis, Can be said to be equal.

DESCRIPTION OF SYMBOLS 10 ... Monitoring system 100 ... Management computer 200 ... Display device 300 ... Host computer 400 ... Storage subsystem 500 ... Network device 600 ... Network

As a result, when the previous information collection start time of the record to be processed is before the end time specified by the time width B and the current information collection start time is later than the start time specified by the time width B (step In S82 (Yes), the processor 102 determines whether or not the record to be processed satisfies the condition of the display condition / filter condition table 132 (step S83). As a result, if the record to be processed satisfies the condition (Yes in step S83), the time is calculated by calculating (Min (Ee, Ue) −Max (Eb, Ub)) / ( Ee− Eb). The probability that an event corresponding to the record occurs in the width B is calculated (step S84). Here, Eb indicates the previous information collection start time, Ee indicates the current information collection start time, Ub indicates the start time of the time width B, Ue indicates the end time of the time width B, Min (X, Y) indicates the smaller of X and Y, and Max (X, Y) indicates the larger of X and Y.

The one or more processors receive (E) a display request designating a predetermined display time period, and (F) change the first monitoring information generated within the predetermined display time period. It is displayed together with the probability of occurrence within a predetermined display time zone, and the probability of (F) is the period of the acquisition time of the first monitoring information and the previous acquisition time that is the source of the change of the first monitoring information. The ratio may be calculated based on a ratio included in the predetermined display time zone. The calculation method may be other than (Min (Ee, Ue) −Max (Eb, Ub)) / ( Ee− Eb). Typically, if other numerical values are the same, a function whose value tends to increase when the degree of overlap between the above-described period (ie, Eb to Ee) and time width B (ie, Ub to Ue) is large may be used. .

Claims (14)

A monitoring system that includes one or more processors and one or more storage resources, and monitors a monitoring target device or / and a component included in the monitoring target device as a monitoring target,
The one or more storage resources store a first time interval and a second time interval for obtaining monitoring information to be monitored, and the first time interval and the second time interval are different from each other. Target or type of monitoring information
The one or more processors are:
(A1) According to the first time interval, acquiring first monitoring information that is the first type of monitoring information of the first monitoring target;
(A2) According to the second time interval, acquiring second monitoring information that is the second type of monitoring information of the second monitoring target;
(B1) identifying a change from the previous time for the first monitoring information, calculating a first change value based on the identified change and the first time interval;
(B2) specifying a change from the previous time for the second monitoring information, calculating a second change value based on the specified change and the second time interval;
(C) displaying the first change value and the second change value on the same screen;
The calculation of the first change value and the second change value is generated based on a predetermined conversion process having a characteristic that the absolute value of the change value becomes smaller as the time interval based on the calculation becomes longer.
Monitoring system. The monitoring system according to claim 1,
The period of the acquisition time and the previous acquisition time of the first monitoring information that is the source of the first change value, and the period of the acquisition time and the previous acquisition time of the second monitoring information that is the source of the second change value And are at least partially overlapping,
The display of the first change value is displayed so as to be temporally related to the second change value.
Monitoring system. The monitoring system according to claim 2,
(C)
(C1) A first graph that displays the first change value in time series with respect to the first axis indicating the time order, and a second graph that displays the second change value in time series with the second axis indicating the time order as a reference. A second graph, and
(C2) The first axis and the second axis face the same direction,
(C3) When the portion on the first axis indicating the overlap period moves in a predetermined angular direction with the first axis, the portion on the second axis indicating the overlap period overlaps.
Monitoring system. The monitoring system according to claim 2,
(C)
(C4) displaying a third graph that displays the first change value and the second change value in time series on the basis of the first axis indicating the time order;
Monitoring system. The monitoring system according to claim 2,
(C)
(C5) displaying a first table that displays the first change value and the second change value in time series based on a predetermined row or column indicating a time order;
Monitoring system. The monitoring system according to claim 3,
The one or more storage resources store monitoring numerical time-series information including a first monitoring numerical value related to the first monitoring target;
The one or more processors are:
(D) displaying a third graph displaying the first monitoring numerical values in time series with respect to the third axis representing the time order;
(D1) The first axis and the third axis face the same direction,
(D2) When the portion on the first axis indicating the overlap period moves in the predetermined angular direction with the first axis, the portion on the third axis indicating the overlap period overlaps.
Monitoring system. The monitoring system according to claim 6,
The one or more processors are:
(E) A display request designating a predetermined display time zone is received,
(F) displaying the change in the first monitoring information that occurred within the predetermined display time zone together with the probability of occurring within the predetermined display time zone;
The probability of (F) is calculated based on the ratio of the acquisition time of the first monitoring information and the previous acquisition time, which are the sources of the change of the first monitoring information, included in the predetermined display time zone. The
Monitoring system. The monitoring system according to claim 7,
The first monitoring target is a predetermined component included in a predetermined monitoring target device,
The change from the previous time about the first monitoring information is addition, change, or deletion of the predetermined component,
The second monitoring target is the predetermined monitoring target device,
The change from the previous time for the second monitoring information is at least addition, change, or deletion of a component included in the predetermined monitoring target device other than the predetermined component.
Monitoring system. A method for monitoring a monitoring target device or / and a component included in the monitoring target device as a monitoring target,
(A0) storing a plurality of time intervals for obtaining monitoring information for a plurality of the monitoring targets;
(A) According to the plurality of time intervals, acquiring a plurality of the monitoring information from a plurality of the monitoring targets,
(B) For each of the plurality of monitoring information, a change value is calculated based on a change from the previous time and a time interval;
(C) displaying a plurality of change values corresponding to a plurality of the monitoring information on the same screen;
The calculation of the change value is generated based on a predetermined conversion process having a characteristic that the absolute value of the change value decreases as the time interval based on the calculation becomes longer.
Method. The method of claim 10, comprising:
Each of the plurality of change values has at least partially overlapped with the period of other change values in the period of the acquisition time of the monitoring information that is the basis of the calculation and the period of the previous acquisition time,
The display of (C) indicates that the one change value and the other change value are temporally related.
Method. The method of claim 10, comprising:
The display of the change value of (C) displays a plurality of change value graphs that display the plurality of change values in time series with respect to the first axis indicating the time order,
The plurality of first axes are oriented in the same direction and have the same time scale interval.
Method. The method of claim 11, comprising:
Stores monitoring numerical time-series information including a predetermined monitoring numerical value for a predetermined monitoring target,
A numerical graph displaying the monitoring numerical values in time series with the second axis indicating the time order as a standard;
The first axis and the second axis are oriented in the same direction,
The length of the first part indicating the predetermined period of the first axis is equal to the length of the second part indicating the predetermined period of the second axis.
Method. The method of claim 9, comprising:
(E) A display request designating a predetermined display time zone is received,
(F) displaying the change in the monitoring information occurring within the predetermined display time period together with the probability of occurring within the predetermined display time;
The probability of (F) is calculated by the ratio of the acquisition time of the monitoring information that is the source of the change and the period of the previous acquisition time included in the predetermined display time zone.
Method. The method of claim 9, comprising:
The plurality of monitoring targets include at least a predetermined monitoring target device and a predetermined component included in the predetermined monitoring target device,
The change from the previous monitoring information regarding the predetermined component is addition, change, or deletion of the predetermined component;
The change of the monitoring information related to the predetermined monitoring target device from the previous time is at least addition, change, or deletion of a component included in the predetermined monitoring target device other than the predetermined component.
Method.

Images